* [PATCH nf] netfilter/xt_u32: validate user space input
@ 2023-08-28 13:21 Wander Lairson Costa
2023-08-28 13:25 ` Wander Lairson Costa
2023-08-30 15:18 ` Pablo Neira Ayuso
0 siblings, 2 replies; 3+ messages in thread
From: Wander Lairson Costa @ 2023-08-28 13:21 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Patrick McHardy, Jan Engelhardt, open list:NETFILTER,
open list:NETFILTER, open list:NETWORKING [GENERAL],
open list
Cc: Wander Lairson Costa
The xt_u32 module doesn't validate the fields in the xt_u32 structure.
An attacker may take advantage of this to trigger an OOB read by setting
the size fields with a value beyond the arrays boundaries.
Add a checkentry function to validate the structure.
This was originally reported by the ZDI project (ZDI-CAN-18408).
Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
---
net/netfilter/xt_u32.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 177b40d08098..117d4615d668 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par)
return ret ^ data->invert;
}
+static int u32_mt_checkentry(const struct xt_mtchk_param *par)
+{
+ const struct xt_u32 *data = par->matchinfo;
+ const struct xt_u32_test *ct;
+ unsigned int i;
+
+ if (data->ntests > ARRAY_SIZE(data->tests))
+ return -EINVAL;
+
+ for (i = 0; i < data->ntests; ++i) {
+ ct = &data->tests[i];
+
+ if (ct->nnums > ARRAY_SIZE(ct->location) ||
+ ct->nvalues > ARRAY_SIZE(ct->value))
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static struct xt_match xt_u32_mt_reg __read_mostly = {
.name = "u32",
.revision = 0,
.family = NFPROTO_UNSPEC,
.match = u32_mt,
+ .checkentry = u32_mt_checkentry,
.matchsize = sizeof(struct xt_u32),
.me = THIS_MODULE,
};
--
2.41.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter/xt_u32: validate user space input
2023-08-28 13:21 [PATCH nf] netfilter/xt_u32: validate user space input Wander Lairson Costa
@ 2023-08-28 13:25 ` Wander Lairson Costa
2023-08-30 15:18 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Wander Lairson Costa @ 2023-08-28 13:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Patrick McHardy, Jan Engelhardt, open list:NETFILTER,
open list:NETFILTER, open list:NETWORKING [GENERAL],
open list
Cc: stable
+stable as I forgot to add it in the Cc section.
On Mon, Aug 28, 2023 at 10:21 AM Wander Lairson Costa <wander@redhat.com> wrote:
>
> The xt_u32 module doesn't validate the fields in the xt_u32 structure.
> An attacker may take advantage of this to trigger an OOB read by setting
> the size fields with a value beyond the arrays boundaries.
>
> Add a checkentry function to validate the structure.
>
> This was originally reported by the ZDI project (ZDI-CAN-18408).
>
> Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
> Signed-off-by: Wander Lairson Costa <wander@redhat.com>
> ---
> net/netfilter/xt_u32.c | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
> diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
> index 177b40d08098..117d4615d668 100644
> --- a/net/netfilter/xt_u32.c
> +++ b/net/netfilter/xt_u32.c
> @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par)
> return ret ^ data->invert;
> }
>
> +static int u32_mt_checkentry(const struct xt_mtchk_param *par)
> +{
> + const struct xt_u32 *data = par->matchinfo;
> + const struct xt_u32_test *ct;
> + unsigned int i;
> +
> + if (data->ntests > ARRAY_SIZE(data->tests))
> + return -EINVAL;
> +
> + for (i = 0; i < data->ntests; ++i) {
> + ct = &data->tests[i];
> +
> + if (ct->nnums > ARRAY_SIZE(ct->location) ||
> + ct->nvalues > ARRAY_SIZE(ct->value))
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
> static struct xt_match xt_u32_mt_reg __read_mostly = {
> .name = "u32",
> .revision = 0,
> .family = NFPROTO_UNSPEC,
> .match = u32_mt,
> + .checkentry = u32_mt_checkentry,
> .matchsize = sizeof(struct xt_u32),
> .me = THIS_MODULE,
> };
> --
> 2.41.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter/xt_u32: validate user space input
2023-08-28 13:21 [PATCH nf] netfilter/xt_u32: validate user space input Wander Lairson Costa
2023-08-28 13:25 ` Wander Lairson Costa
@ 2023-08-30 15:18 ` Pablo Neira Ayuso
1 sibling, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2023-08-30 15:18 UTC (permalink / raw)
To: Wander Lairson Costa
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Patrick McHardy,
Jan Engelhardt, open list:NETFILTER, open list:NETFILTER,
open list:NETWORKING [GENERAL],
open list
On Mon, Aug 28, 2023 at 10:21:07AM -0300, Wander Lairson Costa wrote:
> The xt_u32 module doesn't validate the fields in the xt_u32 structure.
> An attacker may take advantage of this to trigger an OOB read by setting
> the size fields with a value beyond the arrays boundaries.
>
> Add a checkentry function to validate the structure.
>
> This was originally reported by the ZDI project (ZDI-CAN-18408).
Applied to nf, thanks
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-08-30 15:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-28 13:21 [PATCH nf] netfilter/xt_u32: validate user space input Wander Lairson Costa
2023-08-28 13:25 ` Wander Lairson Costa
2023-08-30 15:18 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).